Anonymous

Anonymous

https://tryhackme.com/room/anonymous

Room info:

Try to get the two flags!  Root the machine and prove your understanding of the fundamentals! This is a virtual machine meant for beginners. Acquiring both flags will require some basic knowledge of Linux and privilege escalation methods.
For more information on Linux, check out https://tryhackme.com/room/zthlinux

Task 1 Pwn

Enumeration

As always start an initial scan with NMAP

nmap -sC -sV $target_ip -oA scan.content

After the scan we get an output like this

PORT    STATE SERVICE     VERSION
21/tcp  open  ftp         vsftpd 2.0.8 or later
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_drwxrwxrwx    2 111      113          4096 Jun 04  2020 scripts [NSE: writeable]
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to ::ffff:10.9.166.168
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 300
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 1
|      vsFTPd 3.0.3 - secure, fast, stable
|_End of status
22/tcp  open  ssh         OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 8b:ca:21:62:1c:2b:23:fa:6b:c6:1f:a8:13:fe:1c:68 (RSA)
|   256 95:89:a4:12:e2:e6:ab:90:5d:45:19:ff:41:5f:74:ce (ECDSA)
|_  256 e1:2a:96:a4:ea:8f:68:8f:cc:74:b8:f0:28:72:70:cd (ED25519)
139/tcp open  netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open  netbios-ssn Samba smbd 4.7.6-Ubuntu (workgroup: WORKGROUP)
Service Info: Host: ANONYMOUS; OS: Linux; CPE: cpe:/o:linux:linux_kernel

Host script results:
|_nbstat: NetBIOS name: ANONYMOUS, NetBIOS user: <unknown>, NetBIOS MAC: <unknown> (unknown)
| smb-os-discovery: 
|   OS: Windows 6.1 (Samba 4.7.6-Ubuntu)
|   Computer name: anonymous
|   NetBIOS computer name: ANONYMOUS\x00
|   Domain name: \x00
|   FQDN: anonymous
|_  System time: 2021-01-07T02:54:10+00:00
| smb-security-mode: 
|   account_used: guest
|   authentication_level: user
|   challenge_response: supported
|_  message_signing: disabled (dangerous, but default)
| smb2-security-mode: 
|   2.02: 
|_    Message signing enabled but not required
| smb2-time: 
|   date: 2021-01-07T02:54:10
|_  start_date: N/A

With this you get the answer to the First, Second and Third question of Task 1

Now take note of the scan, there are some interesting things that NMAP discovered.

The first thing is that FTP allows anonymous login. (This will come in use to us later on)

SSH reveals that the machine is running Ubuntu and SMB has been setup.

Now we reach the fourth question

We can get the share from the SMB ports (139 and 445).

I will show you two ways, one with NMAP and one with enum4linux.

If you did not know, you can run various scripts with NMAP to enhance your scanning and get more information from your target(s).

By default NMAP comes with preinstalled scripts and the flag to use them is

(You can get more info here https://nmap.org/nsedoc/)

Lets use smb-enum-users, smb-enum-shares, smb-ls

As you can see NMAP gives a simple but a somewhat detailed output of the scan.

It shows us which shares are available, the users that have access to those shares and smb-ls displays us the content in the shares that we can access as guest.

The second way to enumerate the SMB ports is with enum4linux. (If you do not have enum4linux you can get it from here https://github.com/CiscoCXSecurity/enum4linux).

Simply run enum4linux -a $target_ip

For the sake of space, I have removed some useless information from the output and left out only the important bits. Your output will have a lot of more information.

With this you get the answer to the Fourth question of Task 1.

From the info we have gathered we can see that there is a share that we can access as a guest and one user.

To access the share we can use

Type help to get more information about the commands you can use in smb.

There are two adorable pictures that we can get, however there isn't much information we can get from them with steghide since they require a password.

Now lets get our attention to FTP.

As previously shown from NMAP, we can login to FTP as anonymous (big surprise there x0 )

We can see that there is a scripts directory.

Lets get all the files and go through them. (For more information about FTP type ? in the console or read this https://www.cs.colostate.edu/helpdocs/ftp.html)

We got three files clean.sh removed_files.log to_do.txt

Looking through them, we see that to_do.txt is just a simple note, however removed_files.log and clean.sh are tied. Examining clean.sh, the script removes all files in the /tmp directory and outputs the logs in /var/ftp/scripts/removed_files.log. Judging by this, clean.sh is probably a cronjob that executes once every few minutes, hours, days, etc. (For more info about cronjobs https://ostechnix.com/a-beginners-guide-to-cron-jobs/)

Reverse Shell

If clean.sh is a cron task, we can use this to get a reverse shell, by simply modifying the file and upload it back to the scripts folder.

Download the file, edit it with your text editor and grab a reverse shell code from https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology and Resources/Reverse Shell Cheatsheet.md

My recomendations are Bash TCP, Perl and Python, since those are by default in pretty much every Linux Distro.

Then upload it and start nc -lvnp $PORT and in about 1 minute you'll get a shell back.

Privilige Escalation

Once you're in, I suggest to always Stabilize your shell.

  1. python -c 'import pty;pty.spawn("/bin/bash")'

  2. export TERM=xterm

  3. ^Z (Ctrl + Z) (to background the reverse shell)

  4. stty raw -echo;fg (this will put you back in your reverse shell)

You're dropped in the home directory of the main user in this challenge and can read the user.txt flag.

Now, since there is a script that deletes files in /tmp I'd suggest to go to

Let's get some scripts to enumerate our system.

Here are some suggestions:

And worth to check out https://github.com/jondonas/linux-exploit-suggester-2 (this won't be used in this current challenge, but will end up to be useful in other challenges).

Let's upload our files with

(the last command piping it into tee is good to save the output in a file so that you don't have to rerun the script again if you lose the information, however it is also bad as it leaves traces of your steps).

The output of LinEnum is quite large so I'll just put in the important info that we need.

As we can see, /usr/bin/env has a SUID bit set and is owned by root. This means we can use it to our advantage to get a root shell!

On how to execute this, you can search at https://gtfobins.github.io/ and search for env.

Simply run

And you get root!

Final thoughts

Anonymous is set as a Medium difficulty challenge, however in my oppinion it seems quite easy to finish this challenge.

Just enumerate properly, google search any unknown things and how to exploit them.

A little sidenote, the user is part of the lxd group which means besides the env privesc, we can use lxd to get a root shell too!

PreviousTHM WriteupsNextDaily Bugle

Last updated